Malicious code in getui-library (npm)
The getui-library npm package version 0.0.1 contains malicious code that executes during installation. Its postinstall.js script sends an HTTPS request to a third-party webhook, exfiltrating installer environment details such as hostname, username, platform, working directory, and CI indicators without user consent. This behavior is triggered automatically on npm install and is intended to fingerprint developers who mistakenly install this typosquatted package. The package is considered fully compromising to any system where it is installed, potentially allowing an attacker full control. Immediate removal and secret/key rotation are advised.
AI Analysis
Technical Summary
The getui-library npm package version 0.0.1 includes a postinstall script that performs an unauthorized HTTPS GET request to a remote webhook, sending detailed environment information about the installer. This exfiltration occurs silently during installation, effectively fingerprinting users who install the package, which is a typosquat of the @getd/* namespace. Despite the author's claim of defensive research, the package's behavior constitutes unconsented data exfiltration. Security advisories indicate that any system with this package installed should be treated as fully compromised, with all secrets rotated and the package removed. No official patch or fix is documented.
Potential Impact
Installation of getui-library version 0.0.1 results in unconsented exfiltration of sensitive environment data to a third-party server. The package is considered fully compromising, implying potential full system compromise. Secrets and keys stored on affected systems may be exposed and must be rotated. Removal of the package alone may not guarantee eradication of all malicious artifacts or backdoors introduced by the package.
Mitigation Recommendations
No official patch or fix is available for this malicious package. Immediate removal of getui-library version 0.0.1 is required. All secrets, credentials, and keys on affected systems should be rotated from a secure, uncompromised environment. Treat any system with this package installed as fully compromised and conduct a thorough security assessment. Avoid installing packages from untrusted or typosquatted sources.
Malicious code in getui-library (npm)
Description
The getui-library npm package version 0.0.1 contains malicious code that executes during installation. Its postinstall.js script sends an HTTPS request to a third-party webhook, exfiltrating installer environment details such as hostname, username, platform, working directory, and CI indicators without user consent. This behavior is triggered automatically on npm install and is intended to fingerprint developers who mistakenly install this typosquatted package. The package is considered fully compromising to any system where it is installed, potentially allowing an attacker full control. Immediate removal and secret/key rotation are advised.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The getui-library npm package version 0.0.1 includes a postinstall script that performs an unauthorized HTTPS GET request to a remote webhook, sending detailed environment information about the installer. This exfiltration occurs silently during installation, effectively fingerprinting users who install the package, which is a typosquat of the @getd/* namespace. Despite the author's claim of defensive research, the package's behavior constitutes unconsented data exfiltration. Security advisories indicate that any system with this package installed should be treated as fully compromised, with all secrets rotated and the package removed. No official patch or fix is documented.
Potential Impact
Installation of getui-library version 0.0.1 results in unconsented exfiltration of sensitive environment data to a third-party server. The package is considered fully compromising, implying potential full system compromise. Secrets and keys stored on affected systems may be exposed and must be rotated. Removal of the package alone may not guarantee eradication of all malicious artifacts or backdoors introduced by the package.
Mitigation Recommendations
No official patch or fix is available for this malicious package. Immediate removal of getui-library version 0.0.1 is required. All secrets, credentials, and keys on affected systems should be rotated from a secure, uncompromised environment. Treat any system with this package installed as fully compromised and conduct a thorough security assessment. Avoid installing packages from untrusted or typosquatted sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5474
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-g3m4-7rp4-85gj"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a54adee68715ace438f6c09
Added to database: 07/13/2026, 09:20:46 UTC
Last enriched: 07/13/2026, 09:48:32 UTC
Last updated: 07/24/2026, 17:54:54 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.